The AI omnibus moved every deadline except the ones due next month

Most of the AI Act compliance advice circulating this summer contains a quiet error. It treats the EU's digital omnibus — the package that pushed high-risk AI deadlines to late 2027 and 2028 — as settled law. It is not. The omnibus reached political agreement on May 7 and is expected in the Official Journal before August 2. Until that publication happens, the original timeline technically applies, and the obligations that were never postponed arrive on schedule anyway — starting with the transparency rules that take effect on August 2, 2026, nine days from now.

That gap between what teams believe moved and what actually moved is the map worth drawing. Some deadlines shifted by more than a year. The ones that generate duties next month did not shift at all.

What actually moved

The postponements are real and substantial, once they take legal effect. Under the omnibus agreement, obligations for standalone high-risk systems listed in Annex III — the category covering biometrics, critical infrastructure, education, employment, migration, asylum and border control — move from August 2, 2026 to December 2, 2027, per the European Commission's own AI Act framework page. High-risk AI embedded in regulated products such as machinery, lifts and toys moves further out, to August 2, 2028.

For teams building in those categories, that is a genuine reprieve of sixteen to twenty-four months, and planning around the new dates is reasonable — with one asterisk large enough to carry the rest of this article.

What never moved

Three sets of obligations were left exactly where they were, and two of them are already live or about to be.

General-purpose AI model obligations under Articles 51 through 56 have applied since August 2025 and the omnibus does not touch them, as Gibson Dunn's analysis of the agreement lays out. That is the regime whose enforcement machinery switches on next month — the subject TECHi examined in its look at who is actually exposed when GPAI enforcement begins.

Article 50 transparency requirements also proceed on schedule from August 2, 2026. Systems that interact with people, generate synthetic content, or run emotion recognition must disclose what they are; the only softening in the omnibus is a four-month grace period for watermarking obligations on systems already in the market. For anyone shipping conversational or agentic products into the EU, the practical consequences — including the duty TECHi covered when AI agents were required to say who sent them — start next month regardless of what happened to the high-risk calendar. The same clock governs customer-facing deployments of the enterprise agent platforms now reaching the market, a point worth holding onto when vendors pitch governed agents as compliance-adjacent.

And the Article 5 prohibitions on unacceptable-risk practices have been in force since February 2025. The omnibus actually extends this list rather than trimming it, adding a prohibition on AI-generated non-consensual intimate imagery and child sexual abuse material, with a transitional period running to December 2, 2026.

The limbo mechanism nobody prices

Here is the part that makes confident summaries dangerous. The omnibus's new dates take legal effect only upon formal adoption and publication in the Official Journal — expected, in the Commission's phrasing, before August 2, 2026. Expected is not guaranteed. Until publication, Gibson Dunn notes, the original timeline technically applies.

Follow that logic one step further and the summer's strange situation comes into focus. If publication lands before August 2, the high-risk deferrals activate just as the original deadline would have bitten, and the paper gap closes without consequence. If publication slips past August 2 — even briefly — then for that interval, standalone high-risk systems are formally subject to obligations everyone has been told were postponed. No regulator is likely to build an enforcement action on a gap measured in weeks. But contracts are not regulators: procurement clauses, warranty language and compliance representations that reference "applicable law" do not wait for enforcement discretion.

There is also a simple way to watch the gap close in real time: Official Journal publication is a public event, not a private milestone. The day the omnibus appears in EUR-Lex with a regulation number, the conditional dates become law and every memo written with the one-sentence caveat ages gracefully. Checking for that publication takes a minute a week between now and August 2 — a small habit that converts an ambiguous summer into a dated fact.

The practical reading is not panic; it is precision. Any compliance posture, vendor contract or board summary written this summer should say which timeline it assumes and what happens if the Official Journal date slips. One sentence of conditionality is cheap insurance against a paper exposure window.

Why the advice keeps getting it wrong

The error is structural, not careless, and it has three parts. The first is headline compression: "EU delays AI Act" is a true-enough summary of the omnibus that becomes false the moment a reader applies it to their own product, because the delay covers two annexes, not the act. The second is category confusion — teams hear "high-risk moved" and file their chatbot, their content generator or their foundation-model integration under it, when none of those live in Annex III at all. Their obligations sit in the GPAI articles and Article 50, which are the parts that did not move. The third is the invisibility of legal mechanics in secondary coverage: almost no summary distinguishes a political agreement from a published regulation, so the conditionality — the single most decision-relevant fact this summer — drops out of the version that reaches a product meeting.

The confusion is visible even at the highest-quality end of the reference chain. The implementation timeline maintained by the Future of Life Institute — among the most-cited independent AI Act trackers — still lists August 2, 2026 as the date "the remainder of the AI Act starts to apply." That is correct under the letter of currently published law, and it will become misleading the day the omnibus reaches the Official Journal. When the best trackers can only be right about one timeline at a time, a compliance memo citing them inherits the ambiguity.

The fix costs three questions of any compliance memo: which annex or article does each stated deadline come from, does the date depend on Official Journal publication, and what applies in the meantime. A memo that cannot answer those three is a summary of headlines, not of law.

What each team should do this week

The split calendar assigns different homework by system type, and most of it is light if started now. Providers of general-purpose models should treat next month's enforcement activation as the deadline to have documentation, copyright policy and training-data summaries in the shape the AI Office can actually read. Teams shipping anything conversational or generative into the EU should walk their disclosure UX against Article 50 this week — the label, the moment it appears, and the watermarking path for content, including whether the four-month grace for in-market systems applies to them or only to their vendor. And genuinely high-risk builders get the strangest assignment: plan against December 2027, but keep the evidence trail as if August 2026 still binds, until the Official Journal says otherwise. The cost of that caution is a folder of records; the cost of its absence is a contractual argument nobody wins cleanly.

The quiet additions

Two smaller omnibus changes deserve a line each, because they cut in opposite directions. The bias-detection provisions expand: data processing rights for detecting and correcting bias now extend to all AI systems, not only high-risk ones — a genuine easing for teams that wanted to audit models without a high-risk classification to justify it. And the EU AI Office gains investigation and enforcement powers, which means the institution reading GPAI documentation next month has more reach than the one that existed when those obligations first applied.

Softer deadlines, harder enforcer. That trade is the omnibus in one sentence.

The builder's date map

Stripped to what a team actually schedules against, the calendar now looks like this:

• Live since February 2025: Article 5 prohibitions on unacceptable-risk practices — with the new NCII and CSAM prohibition transitioning in through December 2, 2026.
• Live since August 2025: GPAI model obligations, Articles 51–56 — documentation, copyright policy, training-data summaries. Enforcement powers activate August 2, 2026.
• August 2, 2026: Article 50 transparency for systems that interact with people or generate content — with the four-month watermarking grace for systems already in market.
• December 2, 2027 (once the omnibus is published): standalone Annex III high-risk obligations — biometrics, infrastructure, education, employment, migration, border control.
• August 2, 2028 (same condition): high-risk AI embedded in regulated products.

Every line above carries the same footnote: the last two dates are conditional on Official Journal publication, and the first three are not conditional on anything.

The bottom line

The omnibus did what industry asked: it bought real time for the categories where conformity assessment was going to collide with reality. What it conspicuously did not buy is time on the obligations that describe most of the AI actually shipping in 2026 — general-purpose models and systems that talk to people. Those duties arrive next month, enforced by an office the same omnibus strengthened.

The error pattern to avoid is treating "the deadlines moved" as a sentence about the AI Act. It is a sentence about two annexes of it. Teams that internalize the split — permanent obligations now, postponed obligations later, all of it conditional on a publication date that has not happened yet — will spend August answering regulators' easier questions. Teams that read only the headline will discover that the part of the law that applies to them was never the part that moved.